3.4 Configuration Management

Statement

• Detect the presence of unauthorized or misconfigured system components using {{ insert: param, A.03.04.02E.ODP.01 }}.

• Take the following actions when unauthorized or misconfigured components are detected: {{ insert: param, A.03.04.02E.ODP.02 }}.

Guidance

Monitoring for unauthorized or misconfigured components may be accomplished on an ongoing basis or by the periodic scanning of systems for that purpose. Automated mechanisms may also be used to prevent the connection of unauthorized or misconfigured system components. Automated mechanisms can be implemented in systems or in separate system components. When acquiring and implementing automated mechanisms, organizations consider whether such mechanisms depend on the ability of the system component to support an agent or supplicant in order to be detected since some types of components do not have or cannot support agents (e.g., IoT devices, sensors). Isolation can be achieved, for example, by placing unauthorized system components in separate domains or subnets or quarantining such components. This type of component isolation is commonly referred to as “sandboxing.” This requirement enhances SP 800-171 requirement 03.04.10.

Statement

• (includes expunge and preempt) Ensure that the threat event does not have an impact.

  • Reduce likelihood of occurrence and/or reduce likelihood of impact.

  • The adversary’s efforts or resources cannot be applied or are wasted.

• (includes contain) Make it more difficult for threat events to cause adverse impacts or consequences.

  • Reduce likelihood of impact and reduce level of impact.

  • Adversary activities are restricted in scope, fail to achieve full effect, do not take place in accordance with adversary timeline, or require greater resources than adversary had planned.

• (includes detect) Reduce risk due to ignorance of threat events and possible replicated or similar threat events in the same or similar environments.

  • Reduce likelihood of impact.

  • The adversary loses the advantage of stealth as defenders are better prepared by developing and sharing threat intelligence.

Assessment objective

the presence of unauthorized or misconfigured system components is detected using {{ insert: param, A.03.04.02E.ODP.01 }}.

Assessment objective

one or more of the following actions is/are taken when unauthorized or misconfigured system components are detected: {{ insert: param, A.03.04.02E.ODP.02 }}.

Assessment method

• Configuration management policy procedures addressing system component inventory and configuration settings configuration management plan system configuration settings and associated documentation system component inventory system design documentation change control records common secure configuration checklists alerts or notifications of unauthorized components within the system system monitoring records system maintenance records system audit records system security plan other relevant documents or records

Assessment method

• Personnel with component inventory and security configuration management responsibilities personnel with responsibilities for managing automated mechanisms implementing unauthorized system component detection personnel with information security responsibilities system/network administrators system developers

Assessment method

• Processes for the detection of unauthorized or misconfigured system components automated processes for taking action when unauthorized or misconfigured system components are detected automated mechanisms supporting and/or implementing the detection of unauthorized or misconfigured system components automated mechanisms supporting and/or implementing actions taken when unauthorized or misconfigured system components are detected

Statement

Maintain the currency, completeness, accuracy, and availability of the inventory of system components using {{ insert: param, A.03.04.03E_prm_1 }}.

Guidance

The system component inventory includes system-specific information required for component accountability and to provide support to identify, control, monitor, and verify configuration items based on the authoritative source. The information necessary for the accountability of system components includes the system name, hardware and software component owners, hardware inventory specifications, software license information, software version numbers, and—for networked components—the machine names and network addresses. Inventory specifications include the manufacturer, supplier information, component type, date of receipt, cost, model, serial number, and physical location. System component inventory information can include historic versioning of the information that can be used to track changes in the inventory and its ownership over the lifecycle of the system component inventory. Organizations also use automated mechanisms to implement and maintain authoritative (i.e., up-to-date, complete, accurate, and available) baseline configurations for systems that include hardware and software inventory tools, configuration management tools, and network management tools. Tools can be used to track version numbers on operating systems, applications, types of software installed, and current patch levels. This requirement enhances SP 800-171 requirement 03.04.10.

Statement

• (includes preempt) Ensure that the threat event does not have an impact.

  • Reduce likelihood of occurrence and/or reduce likelihood of impact.

  • The adversary’s efforts or resources cannot be applied or are wasted.

• (includes exert) Make it more difficult for threat events to cause adverse impacts or consequences.

  • Reduce likelihood of impact and reduce level of impact.

  • Adversary activities are restricted in scope, fail to achieve full effect, do not take place in accordance with adversary timeline, or require greater resources than adversary had planned.

• (includes detect) Reduce risk due to ignorance of threat events and possible replicated or similar threat events in the same or similar environments.

  • Reduce likelihood of impact.

  • The adversary loses the advantage of stealth as defenders are better prepared by developing and sharing threat intelligence.

Assessment objective

{{ insert: param, A.03.04.03E.ODP.01 }} are used to maintain the currency of the system component inventory.

Assessment objective

{{ insert: param, A.03.04.03E.ODP.02 }} are used to maintain the completeness of the system component inventory.

Assessment objective

{{ insert: param, A.03.04.03E.ODP.03 }} are used to maintain the accuracy of the system component inventory.

Assessment objective

{{ insert: param, A.03.04.03E.ODP.04 }} are used to maintain the availability of the system component inventory.

Assessment method

• Configuration management policy procedures addressing system component inventory configuration management plan system security plan system design documentation system component inventory change control records system maintenance records system audit records other relevant documents or records

Assessment method

• Personnel with component inventory management responsibilities personnel with information security responsibilities system developers system/network administrators

Assessment method

• Processes for maintaining the system component inventory automated mechanisms supporting and/or implementing the system component inventory

Statement

Maintain the currency, completeness, accuracy, and availability of the baseline configuration of the system using {{ insert: param, A.03.04.04E.ODP.01 }}.

Guidance

Automated mechanisms that help organizations maintain consistent baseline configurations for systems include configuration management tools; hardware, software, and firmware inventory tools; and network management tools. Automated tools can be used to track version numbers on operating systems, applications, the types of software installed, and current patch levels. Automation support for accuracy and currency can be satisfied by the implementation of 03.04.03E for organizations that combine system component inventory and baseline configuration activities. This requirement enhances SP 800-171 requirement 03.04.01.

Statement

• (includes preempt) Ensure that the threat event does not have an impact.

  • Reduce likelihood of occurrence and/or reduce likelihood of impact.

  • The adversary’s efforts or resources cannot be applied or are wasted.

• (includes exert) Make it more difficult for threat events to cause adverse impacts or consequences.

  • Reduce likelihood of impact and reduce level of impact.

  • Adversary activities are restricted in scope, fail to achieve full effect, do not take place in accordance with adversary timeline, or require greater resources than adversary had planned.

• (includes detect) Reduce risk due to ignorance of threat events and possible replicated or similar threat events in the same or similar environments.

  • Reduce likelihood of impact.

  • The adversary loses the advantage of stealth as defenders are better prepared by developing and sharing threat intelligence.

Assessment objective

the currency of the baseline configuration of the system is maintained using {{ insert: param, A.03.04.04E.ODP.01 }}.

Assessment objective

the completeness of the baseline configuration of the system is maintained using {{ insert: param, A.03.04.04E.ODP.01 }}.

Assessment objective

the accuracy of the baseline configuration of the system is maintained using {{ insert: param, A.03.04.04E.ODP.01 }}.

Assessment objective

the availability of the baseline configuration of the system is maintained using {{ insert: param, A.03.04.04E.ODP.01 }}.

Assessment method

• Configuration management policy procedures addressing the baseline configuration of the system configuration management plan system design documentation system architecture and configuration documentation system configuration settings and associated documentation system component inventory configuration change control records system security plan other relevant documents or records

Assessment method

• Personnel with configuration management responsibilities personnel with information security responsibilities system/network administrators

Assessment method

• Processes for managing baseline configurations automated mechanisms implementing baseline configuration maintenance

Statement

Enforce dual authorization for implementing changes to {{ insert: param, A.03.04.05E_prm_1 }}.

Guidance

Dual authorization is also known as two-person control. Organizations employ dual authorization to help ensure that any changes to selected system components and system-level information cannot occur unless two qualified individuals approve and implement such changes. Requiring two individuals to implement system changes provides an increased level of assurance that the proposed changes are correct implementations of approved changes. The individuals are also accountable for the changes that have been implemented. To reduce the risk of collusion, organizations consider rotating dual authorization duties to other individuals. System-level information includes operational procedures. This requirement enhances SP 800-171 requirement 03.04.05.

Statement

• (includes preempt) Ensure that the threat event does not have an impact.

  • Reduce likelihood of occurrence and/or reduce likelihood of impact.

  • The adversary’s efforts or resources cannot be applied or are wasted.

• (includes exert) Make it more difficult for threat events to cause adverse impacts or consequences.

  • Reduce likelihood of impact and reduce level of impact.

  • Adversary activities are restricted in scope, fail to achieve full effect, do not take place in accordance with adversary timeline, or require greater resources than adversary had planned.

Assessment objective

dual authorization for implementing changes to {{ insert: param, A.03.04.05E.ODP.01 }} is enforced.

Assessment objective

dual authorization for implementing changes to {{ insert: param, A.03.04.05E.ODP.02 }} is enforced.

Assessment method

• Configuration management policy procedures addressing access restrictions for changes to the system configuration management plan system design documentation system architecture and configuration documentation system configuration settings and associated documentation change control records system audit records system component inventory system information types system security plan other relevant documents or records

Assessment method

• Personnel with dual authorization enforcement responsibilities for implementing system changes personnel with information security responsibilities system/network administrators

Assessment method

• Processes for managing access restrictions to change mechanisms implementing dual authorization enforcement

Statement

Retain {{ insert: param, A.03.04.06E.ODP.01 }} previous versions of baseline configurations of the system to support rollback.

Guidance

Retaining previous versions of baseline configurations to support rollback includes configuration files for hardware, software, and firmware, configuration records, and associated documentation. This requirement enhances SP 800-171 requirement 03.04.01.

Statement

• (includes preempt) Ensure that the threat event does not have an impact.

  • Reduce likelihood of occurrence and/or reduce likelihood of impact.

  • The adversary’s efforts or resources cannot be applied or are wasted.

• (includes exert) Make it more difficult for threat events to cause adverse impacts or consequences.

  • Reduce likelihood of impact and reduce level of impact.

  • Adversary activities are restricted in scope, fail to achieve full effect, do not take place in accordance with adversary timeline, or require greater resources than adversary had planned.

• (includes shorten and reduce) Restrict the consequences of realized threat events by limiting the damage or effects they cause in terms of time, system resources, and/or mission or business impacts.

  • Reduce level of impact and reduce likelihood of impact of subsequent events in the same threat scenario.

  • The adversary’s effectiveness is restricted.

Assessment objective

{{ insert: param, A.03.04.06E.ODP.01 }} previous versions of baseline configurations of the system are retained to support rollback.

Assessment method

• Configuration management policy procedures addressing the baseline configuration of the system configuration management plan system architecture and configuration documentation system configuration settings and associated documentation copies of previous baseline configuration versions system security plan other relevant documents or records

Assessment method

• Personnel with configuration management responsibilities personnel with information security responsibilities system/network administrators

Assessment method

• Processes for managing baseline configurations

Statement

Test, validate, and document changes to the system before finalizing the implementation of the changes.

Guidance

Changes to systems include modifications to hardware, software, or firmware components and defined configuration settings. Organizations ensure that testing does not interfere with system operations that support organizational missions and business functions. Individuals or groups that conduct the tests understand the system security policies and procedures associated with the specific facilities or processes. Operational systems may need to be taken offline or replicated to the extent feasible before testing can be conducted. If systems must be taken offline for testing, the tests are scheduled to occur during planned system outages whenever possible. If the testing cannot be conducted on operational systems, organizations employ compensating protection measures. This requirement enhances SP 800-171 requirement 03.04.03.

Statement

• (includes preempt) Ensure that the threat event does not have an impact.

  • Reduce likelihood of occurrence and/or reduce likelihood of impact.

  • The adversary’s efforts or resources cannot be applied or are wasted.

• (includes exert) Make it more difficult for threat events to cause adverse impacts or consequences.

  • Reduce likelihood of impact and reduce level of impact.

  • Adversary activities are restricted in scope, fail to achieve full effect, do not take place in accordance with adversary timeline, or require greater resources than adversary had planned.

Assessment objective

changes to the system are tested before finalizing the implementation of the changes.

Assessment objective

changes to the system are validated before finalizing the implementation of the changes.

Assessment objective

changes to the system are documented before finalizing the implementation of the changes.

Assessment method

• Configuration management policy configuration management plan procedures addressing system configuration change control system architecture and configuration documentation system design documentation test records system configuration settings and associated documentation validation records change control records system audit records system security plan other relevant documents or records

Assessment method

• Personnel with configuration change control responsibilities personnel with information security responsibilities members of change control board or similar system/network administrators system developers

Assessment method

• Processes for configuration change control mechanisms supporting and/or implementing, testing, validating, and documenting system changes

Statement

Provide a centralized repository for the inventory of system components.

Guidance

Organizations may implement centralized system component inventories that include components from all organizational systems. Centralized repositories of component inventories provide opportunities for efficiencies in accounting for organizational hardware, software, and firmware assets. Such repositories can help organizations rapidly identify the location and responsible individuals of system components that have been compromised, breached, or are otherwise in need of mitigation actions. This requirement enhances SP 800-171 requirement 03.04.10.

Statement

• (includes preempt) Ensure that the threat event does not have an impact.

  • Reduce likelihood of occurrence and/or reduce likelihood of impact.

  • The adversary’s efforts or resources cannot be applied or are wasted.

• (includes exert) Make it more difficult for threat events to cause adverse impacts or consequences.

  • Reduce likelihood of impact and reduce level of impact.

  • Adversary activities are restricted in scope, fail to achieve full effect, do not take place in accordance with adversary timeline, or require greater resources than adversary had planned.

Assessment objective

a centralized repository for the inventory of system components is provided.

Assessment method

• Configuration management policy procedures addressing system component inventory configuration management plan system design documentation system security plan system component inventory system configuration settings and associated documentation change control records system security plan other relevant documents or records

Assessment method

• Organizational personnel with component inventory management responsibilities organizational personnel with security responsibilities

Assessment method

• Organizational processes for managing the system component inventory mechanisms supporting and/or implementing system component inventory